## Domain allowed access.
@@ -1453,17 +1244,13 @@ template(`userdom_security_admin_template',`
logging_read_audit_config($1)
seutil_manage_bin_policy($1)
- seutil_run_checkpolicy($1,$2,$3)
- seutil_run_loadpolicy($1,$2,$3)
- seutil_run_semanage($1,$2,$3)
- seutil_run_setfiles($1, $2, $3)
-
- staff_dontaudit_append_home_content_files($1)
-
- sysadm_dontaudit_read_home_content_files($1)
+ seutil_run_checkpolicy($1,$2)
+ seutil_run_loadpolicy($1,$2)
+ seutil_run_semanage($1,$2)
+ seutil_run_setfiles($1, $2)
optional_policy(`
- aide_run($1,$2, $3)
+ aide_run($1,$2)
')
optional_policy(`
@@ -1475,2523 +1262,186 @@ template(`userdom_security_admin_template',`
')
optional_policy(`
- ipsec_run_setkey($1,$2,$3)
+ ipsec_run_setkey($1,$2)
')
optional_policy(`
- netlabel_run_mgmt($1,$2, $3)
+ netlabel_run_mgmt($1,$2)
')
')
########################################
##
-## Change to the generic user role.
+## Make the specified type usable in a
+## user home directory.
##
-##
+##
##
-## The prefix of the user role (e.g., user
-## is the prefix for user_r).
+## Type to be used as a file in the
+## user home directory.
##
##
-##
#
-template(`userdom_role_change_generic_user',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_role_change_template() instead.')
- unprivuser_role_change_template($1)
+interface(`userdom_user_home_content',`
+ gen_require(`
+ type user_home_t;
+ ')
+
+ allow $1 user_home_t:filesystem associate;
+ files_type($1)
+ ubac_constrained($1)
')
########################################
##
-## Change from the generic user role.
+## Set the attributes of a user pty.
##
-##
-##
-## Change from the generic user role to
-## the specified role.
-##
-##
-## This is a template to support third party modules
-## and its use is not allowed in upstream reference
-## policy.
-##
-##
-##
+##
##
-## The prefix of the user role (e.g., user
-## is the prefix for user_r).
+## Domain allowed access.
##
##
-##
#
-template(`userdom_role_change_from_generic_user',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_role_change_to_template() instead.')
- unprivuser_role_change_to_template($1)
+interface(`userdom_setattr_user_ptys',`
+ gen_require(`
+ type user_devpts_t;
+ ')
+
+ allow $1 user_devpts_t:chr_file setattr;
')
########################################
##
-## Change to the staff user role.
+## Create a user pty.
##
-##
+##
##
-## The prefix of the user role (e.g., user
-## is the prefix for user_r).
+## Domain allowed access.
##
##
-##
#
-template(`userdom_role_change_staff',`
- refpolicywarn(`$0($*) has been deprecated. Please use staff_role_change_template() instead.')
- staff_role_change_template($1)
+interface(`userdom_create_user_pty',`
+ gen_require(`
+ type user_devpts_t;
+ ')
+
+ term_create_pty($1, user_devpts_t)
')
########################################
##
-## Change from the staff user role.
+## Get the attributes of user home directories.
##
-##
-##
-## Change from the staff user role to
-## the specified role.
-##
-##
-## This is a template to support third party modules
-## and its use is not allowed in upstream reference
-## policy.
-##
-##
-##
+##
##
-## The prefix of the user role (e.g., user
-## is the prefix for user_r).
+## Domain allowed access.
##
##
-##
#
-template(`userdom_role_change_from_staff',`
- refpolicywarn(`$0($*) has been deprecated. Please use staff_role_change_to_template() instead.')
- staff_role_change_to_template($1)
+interface(`userdom_getattr_user_home_dirs',`
+ gen_require(`
+ type user_home_dir_t;
+ ')
+
+ allow $1 user_home_dir_t:dir getattr_dir_perms;
+ files_search_home($1)
')
########################################
##
-## Change to the sysadm user role.
+## Do not audit attempts to get the attributes of user home directories.
##
-##
+##
##
-## The prefix of the user role (e.g., user
-## is the prefix for user_r).
+## Domain allowed access.
##
##
-##
#
-template(`userdom_role_change_sysadm',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_role_change_template() instead.')
- sysadm_role_change_template($1)
+interface(`userdom_dontaudit_getattr_user_home_dirs',`
+ gen_require(`
+ type user_home_dir_t;
+ ')
+
+ dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
')
########################################
##
-## Change from the sysadm user role.
+## Search user home directories.
##
-##
-##
-## Change from the sysadm user role to
-## the specified role.
-##
-##
-## This is a template to support third party modules
-## and its use is not allowed in upstream reference
-## policy.
-##
-##
-##
+##
##
-## The prefix of the user role (e.g., user
-## is the prefix for user_r).
+## Domain allowed access.
##
##
-##
#
-template(`userdom_role_change_from_sysadm',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_role_change_to_template() instead.')
- sysadm_role_change_to_template($1)
+interface(`userdom_search_user_home_dirs',`
+ gen_require(`
+ type user_home_dir_t;
+ ')
+
+ allow $1 user_home_dir_t:dir search_dir_perms;
+ files_search_home($1)
')
########################################
##
-## Change to the secadm user role.
+## Search user home directories.
##
-##
+##
##
-## The prefix of the user role (e.g., user
-## is the prefix for user_r).
+## Domain allowed access.
##
##
-##
#
-template(`userdom_role_change_secadm',`
- refpolicywarn(`$0($*) has been deprecated. Please use secadm_role_change_template() instead.')
- secadm_role_change_template($1)
+interface(`userdom_dontaudit_search_user_home_dirs',`
+ gen_require(`
+ type user_home_dir_t;
+ ')
+
+ dontaudit $1 user_home_dir_t:dir search_dir_perms;
')
########################################
##
-## Change from the secadm user role.
+## List user home directories.
##
-##
-##
-## Change from the secadm user role to
-## the specified role.
-##
-##
-## This is a template to support third party modules
-## and its use is not allowed in upstream reference
-## policy.
-##
-##
-##
+##
##
-## The prefix of the user role (e.g., user
-## is the prefix for user_r).
+## Domain allowed access.
##
##
-##
#
-template(`userdom_role_change_from_secadm',`
- refpolicywarn(`$0($*) has been deprecated. Please use secadm_role_change_to_template() instead.')
- secadm_role_change_to_template($1)
-')
+interface(`userdom_list_user_home_dirs',`
+ gen_require(`
+ type user_home_dir_t;
+ ')
-########################################
-##
-## Change to the auditadm user role.
-##
-##
-##
-## The prefix of the auditadm role (e.g., user
-## is the prefix for user_r).
-##
-##
-##
-#
-template(`userdom_role_change_auditadm',`
- refpolicywarn(`$0($*) has been deprecated. Please use auditadm_role_change_template() instead.')
- auditadm_role_change_template($1)
-')
-
-########################################
-##
-## Change from the auditadm user role.
-##
-##
-##
-## Change from the auditadm user role to
-## the specified role.
-##
-##
-## This is a template to support third party modules
-## and its use is not allowed in upstream reference
-## policy.
-##
-##
-##
-##
-## The prefix of the user role (e.g., user
-## is the prefix for user_r).
-##
-##
-##
-#
-template(`userdom_role_change_from_auditadm',`
- refpolicywarn(`$0($*) has been deprecated. Please use auditadm_role_change_to_template() instead.')
- auditadm_role_change_to_template($1)
-')
-
-########################################
-##
-## Make the specified type usable in a
-## user home directory.
-##
-##
-##
-## Make the specified type usable in a
-## user home directory.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Type to be used as a file in the
-## user home directory.
-##
-##
-#
-template(`userdom_user_home_content',`
- gen_require(`
- attribute $1_file_type;
- ')
-
- typeattribute $2 $1_file_type;
- files_type($2)
-')
-
-########################################
-##
-## Set the attributes of a user pty.
-##
-##
-##
-## Set the attributes of a user pty.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_setattr_user_ptys',`
- gen_require(`
- type $1_devpts_t;
- ')
-
- allow $2 $1_devpts_t:chr_file setattr;
-')
-
-########################################
-##
-## Create a user pty.
-##
-##
-##
-## Create a user pty.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_create_user_pty',`
- gen_require(`
- type $1_devpts_t;
- ')
-
- term_create_pty($2, $1_devpts_t)
-')
-
-########################################
-##
-## Search user home directories.
-##
-##
-##
-## Search user home directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_search_user_home_dirs',`
- gen_require(`
- type $1_home_dir_t;
- ')
-
- files_search_home($2)
- allow $2 $1_home_dir_t:dir search_dir_perms;
-')
-
-########################################
-##
-## List user home directories.
-##
-##
-##
-## List user home directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_list_user_home_dirs',`
- gen_require(`
- type $1_home_dir_t;
- ')
-
- files_search_home($2)
- allow $2 $1_home_dir_t:dir list_dir_perms;
-')
-
-########################################
-##
-## Do a domain transition to the specified
-## domain when executing a program in the
-## user home directory.
-##
-##
-##
-## Do a domain transition to the specified
-## domain when executing a program in the
-## user home directory.
-##
-##
-## No interprocess communication (signals, pipes,
-## etc.) is provided by this interface since
-## the domains are not owned by this module.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-##
-##
-## Domain to transition to.
-##
-##
-#
-template(`userdom_user_home_domtrans',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- files_search_home($2)
- allow $2 $1_home_dir_t:dir search_dir_perms;
- domain_auto_trans($2,$1_home_t,$3)
-')
-
-########################################
-##
-## Do not audit attempts to list user home subdirectories.
-##
-##
-##
-## Do not audit attempts to list user home subdirectories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit
-##
-##
-#
-template(`userdom_dontaudit_list_user_home_dirs',`
- gen_require(`
- type $1_home_dir_t;
- ')
-
- dontaudit $2 $1_home_dir_t:dir list_dir_perms;
-')
-
-########################################
-##
-## Create, read, write, and delete directories
-## in a user home subdirectory.
-##
-##
-##
-## Create, read, write, and delete directories
-## in a user home subdirectory.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_home_content_dirs',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- files_search_home($2)
- manage_dirs_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t)
-')
-
-########################################
-##
-## Do not audit attempts to set the
-## attributes of user home files.
-##
-##
-##
-## Do not audit attempts to set the
-## attributes of user home files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_dontaudit_setattr_user_home_content_files',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- dontaudit $2 $1_home_t:file setattr;
-')
-
-########################################
-##
-## Read user home files.
-##
-##
-##
-## Read user home files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_read_user_home_content_files',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- files_search_home($2)
- read_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t)
-')
-
-########################################
-##
-## Do not audit attempts to read user home files.
-##
-##
-##
-## Do not audit attempts to read user home files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_read_user_home_content_files',`
- gen_require(`
- type $1_home_t;
- ')
-
- dontaudit $2 $1_home_t:dir list_dir_perms;
- dontaudit $2 $1_home_t:file read_file_perms;
-')
-
-########################################
-##
-## Do not audit attempts to write user home files.
-##
-##
-##
-## Do not audit attempts to write user home files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_write_user_home_content_files',`
- gen_require(`
- type $1_home_t;
- ')
-
- dontaudit $2 $1_home_t:file write;
-')
-
-########################################
-##
-## Read user home subdirectory symbolic links.
-##
-##
-##
-## Read user home subdirectory symbolic links.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_read_user_home_content_symlinks',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- files_search_home($2)
- read_lnk_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t)
-')
-
-########################################
-##
-## Execute user home files.
-##
-##
-##
-## Execute user home files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_exec_user_home_content_files',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- files_search_home($2)
- exec_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t)
-')
-
-########################################
-##
-## Do not audit attempts to execute user home files.
-##
-##
-##
-## Do not audit attempts to execute user home files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_dontaudit_exec_user_home_content_files',`
- gen_require(`
- type $1_home_t;
- ')
-
- dontaudit $2 $1_home_t:file execute;
-')
-
-########################################
-##
-## Create, read, write, and delete files
-## in a user home subdirectory.
-##
-##
-##
-## Create, read, write, and delete files
-## in a user home subdirectory.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_home_content_files',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- files_search_home($2)
- allow $2 $1_home_dir_t:dir search_dir_perms;
- manage_files_pattern($2,$1_home_t,$1_home_t)
-')
-
-########################################
-##
-## Do not audit attempts to create, read, write, and delete directories
-## in a user home subdirectory.
-##
-##
-##
-## Do not audit attempts to create, read, write, and delete directories
-## in a user home subdirectory.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_dontaudit_manage_user_home_content_dirs',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- dontaudit $2 $1_home_t:dir manage_dir_perms;
-')
-
-########################################
-##
-## Create, read, write, and delete symbolic links
-## in a user home subdirectory.
-##
-##
-##
-## Create, read, write, and delete symbolic links
-## in a user home subdirectory.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_home_content_symlinks',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- files_search_home($2)
- allow $2 $1_home_dir_t:dir search_dir_perms;
- manage_lnk_files_pattern($2,$1_home_t,$1_home_t)
-')
-
-########################################
-##
-## Create, read, write, and delete named pipes
-## in a user home subdirectory.
-##
-##
-##
-## Create, read, write, and delete named pipes
-## in a user home subdirectory.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_home_content_pipes',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- files_search_home($2)
- allow $2 $1_home_dir_t:dir search_dir_perms;
- manage_fifo_files_pattern($2,$1_home_t,$1_home_t)
-')
-
-########################################
-##
-## Create, read, write, and delete named sockets
-## in a user home subdirectory.
-##
-##
-##
-## Create, read, write, and delete named sockets
-## in a user home subdirectory.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_home_content_sockets',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- files_search_home($2)
- allow $2 $1_home_dir_t:dir search_dir_perms;
- manage_sock_files_pattern($2,$1_home_t,$1_home_t)
-')
-
-########################################
-##
-## Create objects in a user home directory
-## with an automatic type transition to
-## a specified private type.
-##
-##
-##
-## Create objects in a user home directory
-## with an automatic type transition to
-## a specified private type.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-##
-##
-## The type of the object to create.
-##
-##
-##
-##
-## The class of the object to be created. If not
-## specified, file is used.
-##
-##
-#
-template(`userdom_user_home_dir_filetrans',`
- gen_require(`
- type $1_home_dir_t;
- ')
-
- files_search_home($2)
- filetrans_pattern($2,$1_home_dir_t,$3,$4)
-')
-
-########################################
-##
-## Create objects in a user home directory
-## with an automatic type transition to
-## a specified private type.
-##
-##
-##
-## Create objects in a user home directory
-## with an automatic type transition to
-## a specified private type.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-##
-##
-## The type of the object to create.
-##
-##
-##
-##
-## The class of the object to be created. If not
-## specified, file is used.
-##
-##
-#
-template(`userdom_user_home_content_filetrans',`
- gen_require(`
- type $1_home_t;
- ')
-
- files_search_home($2)
- filetrans_pattern($2,$1_home_t,$3,$4)
-')
-
-########################################
-##
-## Create objects in a user home directory
-## with an automatic type transition to
-## the user home file type.
-##
-##
-##
-## Create objects in a user home directory
-## with an automatic type transition to
-## the user home file type.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-##
-##
-## The class of the object to be created. If not
-## specified, file is used.
-##
-##
-#
-template(`userdom_user_home_dir_filetrans_user_home_content',`
- gen_require(`
- type $1_home_dir_t, $1_home_t;
- ')
-
- files_search_home($2)
- filetrans_pattern($2,$1_home_dir_t,$1_home_t,$3)
-')
-
-########################################
-##
-## Write to user temporary named sockets.
-##
-##
-##
-## Write to user temporary named sockets.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_write_user_tmp_sockets',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_search_tmp($2)
- allow $2 $1_tmp_t:sock_file write;
-')
-
-########################################
-##
-## List user temporary directories.
-##
-##
-##
-## List user temporary directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_list_user_tmp',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_search_tmp($2)
- allow $2 $1_tmp_t:dir list_dir_perms;
-')
-
-########################################
-##
-## Do not audit attempts to list user
-## temporary directories.
-##
-##
-##
-## Do not audit attempts to list user
-## temporary directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_list_user_tmp',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- dontaudit $2 $1_tmp_t:dir list_dir_perms;
-')
-
-########################################
-##
-## Do not audit attempts to manage users
-## temporary directories.
-##
-##
-##
-## Do not audit attempts to manage users
-## temporary directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_manage_user_tmp_dirs',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- dontaudit $2 $1_tmp_t:dir manage_dir_perms;
-')
-
-########################################
-##
-## Read user temporary files.
-##
-##
-##
-## Read user temporary files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_read_user_tmp_files',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_search_tmp($2)
- allow $2 $1_tmp_t:dir list_dir_perms;
- read_files_pattern($2,$1_tmp_t,$1_tmp_t)
-')
-
-########################################
-##
-## Do not audit attempts to read users
-## temporary files.
-##
-##
-##
-## Do not audit attempts to read users
-## temporary files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_read_user_tmp_files',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- dontaudit $2 $1_tmp_t:file read_file_perms;
-')
-
-########################################
-##
-## Do not audit attempts to append users
-## temporary files.
-##
-##
-##
-## Do not audit attempts to append users
-## temporary files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_append_user_tmp_files',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- dontaudit $2 $1_tmp_t:file append;
-')
-
-########################################
-##
-## Read and write user temporary files.
-##
-##
-##
-## Read and write user temporary files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_rw_user_tmp_files',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_search_tmp($2)
- allow $2 $1_tmp_t:dir list_dir_perms;
- rw_files_pattern($2,$1_tmp_t,$1_tmp_t)
-')
-
-########################################
-##
-## Do not audit attempts to manage users
-## temporary files.
-##
-##
-##
-## Do not audit attempts to manage users
-## temporary files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_manage_user_tmp_files',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- dontaudit $2 $1_tmp_t:file manage_file_perms;
-')
-
-########################################
-##
-## Read user
-## temporary symbolic links.
-##
-##
-##
-## Read user
-## temporary symbolic links.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_read_user_tmp_symlinks',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_search_tmp($2)
- allow $2 $1_tmp_t:dir list_dir_perms;
- read_lnk_files_pattern($2,$1_tmp_t,$1_tmp_t)
-')
-
-########################################
-##
-## Create, read, write, and delete user
-## temporary directories.
-##
-##
-##
-## Create, read, write, and delete user
-## temporary directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_tmp_dirs',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_search_tmp($2)
- manage_dirs_pattern($2,$1_tmp_t,$1_tmp_t)
-')
-
-########################################
-##
-## Create, read, write, and delete user
-## temporary files.
-##
-##
-##
-## Create, read, write, and delete user
-## temporary files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_tmp_files',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_search_tmp($2)
- manage_files_pattern($2,$1_tmp_t,$1_tmp_t)
-')
-
-########################################
-##
-## Create, read, write, and delete user
-## temporary symbolic links.
-##
-##
-##
-## Create, read, write, and delete user
-## temporary symbolic links.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_tmp_symlinks',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_search_tmp($2)
- manage_lnk_files_pattern($2,$1_tmp_t,$1_tmp_t)
-')
-
-########################################
-##
-## Create, read, write, and delete user
-## temporary named pipes.
-##
-##
-##
-## Create, read, write, and delete user
-## temporary named pipes.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_tmp_pipes',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_search_tmp($2)
- manage_fifo_files_pattern($2,$1_tmp_t,$1_tmp_t)
-')
-
-########################################
-##
-## Create, read, write, and delete user
-## temporary named sockets.
-##
-##
-##
-## Create, read, write, and delete user
-## temporary named sockets.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_tmp_sockets',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_search_tmp($2)
- manage_sock_files_pattern($2,$1_tmp_t,$1_tmp_t)
-')
-
-########################################
-##
-## Create objects in a user temporary directory
-## with an automatic type transition to
-## a specified private type.
-##
-##
-##
-## Create objects in a user temporary directory
-## with an automatic type transition to
-## a specified private type.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-##
-##
-## The type of the object to create.
-##
-##
-##
-##
-## The class of the object to be created. If not
-## specified, file is used.
-##
-##
-#
-template(`userdom_user_tmp_filetrans',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- filetrans_pattern($2,$1_tmp_t,$3,$4)
- files_search_tmp($2)
-')
-
-########################################
-##
-## Create objects in the temporary directory
-## with an automatic type transition to
-## the user temporary type.
-##
-##
-##
-## Create objects in the temporary directory
-## with an automatic type transition to
-## the user temporary type.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-##
-##
-## The class of the object to be created. If not
-## specified, file is used.
-##
-##
-#
-template(`userdom_tmp_filetrans_user_tmp',`
- gen_require(`
- type $1_tmp_t;
- ')
-
- files_tmp_filetrans($2,$1_tmp_t,$3)
-')
-
-########################################
-##
-## Read user tmpfs files.
-##
-##
-##
-## Read user tmpfs files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_rw_user_tmpfs_files',`
- gen_require(`
- type $1_tmpfs_t;
- ')
-
- fs_search_tmpfs($2)
- allow $2 $1_tmpfs_t:dir list_dir_perms;
- rw_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
- read_lnk_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
-')
-
-########################################
-##
-## List users untrusted directories.
-##
-##
-##
-## List users untrusted directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_list_user_untrusted_content',`
- gen_require(`
- type $1_untrusted_content_t;
- ')
-
- allow $2 $1_untrusted_content_t:dir list_dir_perms;
-')
-
-########################################
-##
-## Do not audit attempts to list user
-## untrusted directories.
-##
-##
-##
-## Do not audit attempts to read user
-## untrusted directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_list_user_untrusted_content',`
- gen_require(`
- type $1_untrusted_content_t;
- ')
-
- dontaudit $2 $1_untrusted_content_t:dir list_dir_perms;
-')
-
-########################################
-##
-## Create, read, write, and delete users untrusted directories.
-##
-##
-##
-## Create, read, write, and delete users untrusted directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_untrusted_content_dirs',`
- gen_require(`
- type $1_untrusted_content_t;
- ')
-
- allow $2 $1_untrusted_content_t:dir manage_dir_perms;
-')
-
-########################################
-##
-## Read user untrusted files.
-##
-##
-##
-## Read user untrusted files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_read_user_untrusted_content_files',`
- gen_require(`
- type $1_untrusted_content_t;
- ')
-
- allow $2 $1_untrusted_content_t:dir list_dir_perms;
- read_files_pattern($2,$1_untrusted_content_t,$1_untrusted_content_t)
-')
-
-########################################
-##
-## Manage user untrusted files.
-##
-##
-##
-## Create, read, write, and delete untrusted files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_untrusted_content_files',`
- gen_require(`
- type $1_untrusted_content_t;
- ')
-
- manage_files_pattern($2,$1_untrusted_content_t,$1_untrusted_content_t)
-')
-
-########################################
-##
-## Manage user untrusted tmp files.
-##
-##
-##
-## Create, read, write, and delete untrusted tmp files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_manage_user_untrusted_content_tmp_files',`
- gen_require(`
- type $1_untrusted_content_tmp_t;
- ')
-
- manage_files_pattern($2,$1_untrusted_content_tmp_t,$1_untrusted_content_tmp_t)
-')
-
-########################################
-##
-## Do not audit attempts to read users
-## untrusted files.
-##
-##
-##
-## Do not audit attempts to read users
-## untrusted files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_read_user_untrusted_content_files',`
- gen_require(`
- type $1_untrusted_content_t;
- ')
-
- dontaudit $2 $1_untrusted_content_t:file read_file_perms;
-')
-
-########################################
-##
-## Read user untrusted symbolic links.
-##
-##
-##
-## Read user untrusted symbolic links.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_read_user_untrusted_content_symlinks',`
- gen_require(`
- type $1_untrusted_content_t;
- ')
-
- allow $2 $1_untrusted_content_t:dir list_dir_perms;
- read_lnk_files_pattern($2,$1_untrusted_content_t,$1_untrusted_content_t)
-')
-
-########################################
-##
-## List users temporary untrusted directories.
-##
-##
-##
-## List users temporary untrusted directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_list_user_tmp_untrusted_content',`
- gen_require(`
- type $1_untrusted_content_tmp_t;
- ')
-
- allow $2 $1_untrusted_content_tmp_t:dir list_dir_perms;
-')
-
-########################################
-##
-## Do not audit attempts to list user
-## temporary untrusted directories.
-##
-##
-##
-## Do not audit attempts to list user
-## temporary directories.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_list_user_tmp_untrusted_content',`
- gen_require(`
- type $1_untrusted_content_tmp_t;
- ')
-
- dontaudit $2 $1_untrusted_content_tmp_t:dir list_dir_perms;
-')
-
-########################################
-##
-## Read user temporary untrusted files.
-##
-##
-##
-## Read user temporary untrusted files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_read_user_tmp_untrusted_content_files',`
- gen_require(`
- type $1_untrusted_content_tmp_t;
- ')
-
- allow $2 $1_untrusted_content_tmp_t:dir list_dir_perms;
- read_files_pattern($2,$1_untrusted_content_tmp_t,$1_untrusted_content_tmp_t)
-')
-
-########################################
-##
-## Do not audit attempts to read users
-## temporary untrusted files.
-##
-##
-##
-## Do not audit attempts to read users
-## temporary untrusted files.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-template(`userdom_dontaudit_read_user_tmp_untrusted_content_files',`
- gen_require(`
- type $1_untrusted_content_tmp_t;
- ')
-
- dontaudit $2 $1_untrusted_content_tmp_t:file read_file_perms;
-')
-
-########################################
-##
-## Read user temporary untrusted symbolic links.
-##
-##
-##
-## Read user temporary untrusted symbolic links.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_read_user_tmp_untrusted_content_symlinks',`
- gen_require(`
- type $1_untrusted_content_tmp_t;
- ')
-
- allow $2 $1_untrusted_content_tmp_t:dir list_dir_perms;
- read_lnk_files_pattern($2,$1_untrusted_content_tmp_t,$1_untrusted_content_tmp_t)
-')
-
-########################################
-##
-## Read all user untrusted content files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_read_all_untrusted_content',`
- gen_require(`
- attribute untrusted_content_type;
- ')
-
- allow $1 untrusted_content_type:dir list_dir_perms;
- read_files_pattern($1,untrusted_content_type,untrusted_content_type)
- read_lnk_files_pattern($1,untrusted_content_type,untrusted_content_type)
-')
-
-########################################
-##
-## Read all user temporary untrusted content files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_read_all_tmp_untrusted_content',`
- gen_require(`
- attribute untrusted_content_tmp_type;
- ')
-
- allow $1 untrusted_content_tmp_type:dir list_dir_perms;
- read_files_pattern($1,untrusted_content_tmp_type,untrusted_content_tmp_type)
- read_lnk_files_pattern($1,untrusted_content_tmp_type,untrusted_content_tmp_type)
-')
-
-########################################
-##
-## Set the attributes of a user domain tty.
-##
-##
-##
-## Set the attributes of a user domain tty.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_setattr_user_ttys',`
- gen_require(`
- type $1_tty_device_t;
- ')
-
- allow $2 $1_tty_device_t:chr_file setattr;
-')
-
-########################################
-##
-## Read and write a user domain tty.
-##
-##
-##
-## Read and write a user domain tty.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_use_user_ttys',`
- gen_require(`
- type $1_tty_device_t;
- ')
-
- allow $2 $1_tty_device_t:chr_file rw_term_perms;
-')
-
-########################################
-##
-## Read and write a user domain tty and pty.
-##
-##
-##
-## Read and write a user domain tty and pty.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_use_user_terminals',`
- gen_require(`
- type $1_tty_device_t, $1_devpts_t;
- ')
-
- allow $2 $1_tty_device_t:chr_file rw_term_perms;
- allow $2 $1_devpts_t:chr_file rw_term_perms;
- term_list_ptys($2)
-')
-
-########################################
-##
-## Do not audit attempts to read and write
-## a user domain tty and pty.
-##
-##
-##
-## Do not audit attempts to read and write
-## a user domain tty and pty.
-##
-##
-## This is a templated interface, and should only
-## be called from a per-userdomain template.
-##
-##
-##
-##
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-##
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-template(`userdom_dontaudit_use_user_terminals',`
- gen_require(`
- type $1_tty_device_t, $1_devpts_t;
- ')
-
- dontaudit $2 $1_tty_device_t:chr_file rw_term_perms;
- dontaudit $2 $1_devpts_t:chr_file rw_term_perms;
-')
-
-########################################
-##
-## Execute a shell in all user domains. This
-## is an explicit transition, requiring the
-## caller to use setexeccon().
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_spec_domtrans_all_users',`
- gen_require(`
- attribute userdomain;
- ')
-
- corecmd_shell_spec_domtrans($1,userdomain)
- allow userdomain $1:fd use;
- allow userdomain $1:fifo_file rw_file_perms;
- allow userdomain $1:process sigchld;
-')
-
-########################################
-##
-## Execute an Xserver session in all unprivileged user domains. This
-## is an explicit transition, requiring the
-## caller to use setexeccon().
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_xsession_spec_domtrans_all_users',`
- gen_require(`
- attribute userdomain;
- ')
-
- xserver_xsession_spec_domtrans($1,userdomain)
- allow userdomain $1:fd use;
- allow userdomain $1:fifo_file rw_file_perms;
- allow userdomain $1:process sigchld;
-')
-
-########################################
-##
-## Execute a shell in all unprivileged user domains. This
-## is an explicit transition, requiring the
-## caller to use setexeccon().
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_spec_domtrans_unpriv_users',`
- gen_require(`
- attribute unpriv_userdomain;
- ')
-
- corecmd_shell_spec_domtrans($1,unpriv_userdomain)
- allow unpriv_userdomain $1:fd use;
- allow unpriv_userdomain $1:fifo_file rw_file_perms;
- allow unpriv_userdomain $1:process sigchld;
-')
-
-########################################
-##
-## Execute an Xserver session in all unprivileged user domains. This
-## is an explicit transition, requiring the
-## caller to use setexeccon().
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_xsession_spec_domtrans_unpriv_users',`
- gen_require(`
- attribute unpriv_userdomain;
- ')
-
- xserver_xsession_spec_domtrans($1,unpriv_userdomain)
- allow unpriv_userdomain $1:fd use;
- allow unpriv_userdomain $1:fifo_file rw_file_perms;
- allow unpriv_userdomain $1:process sigchld;
-')
-
-########################################
-##
-## Manage unpriviledged user SysV sempaphores.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_manage_unpriv_user_semaphores',`
- gen_require(`
- attribute unpriv_userdomain;
- ')
-
- allow $1 unpriv_userdomain:sem create_sem_perms;
-')
-
-########################################
-##
-## Manage unpriviledged user SysV shared
-## memory segments.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_manage_unpriv_user_shared_mem',`
- gen_require(`
- attribute unpriv_userdomain;
- ')
-
- allow $1 unpriv_userdomain:shm create_shm_perms;
+ allow $1 user_home_dir_t:dir list_dir_perms;
+ files_search_home($1)
')
########################################
##
-## Execute bin_t in the unprivileged user domains. This
-## is an explicit transition, requiring the
-## caller to use setexeccon().
+## Do not audit attempts to list user home subdirectories.
##
##
##
-## Domain allowed access.
+## Domain to not audit
##
##
#
-interface(`userdom_bin_spec_domtrans_unpriv_users',`
+interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
- attribute unpriv_userdomain;
+ type user_home_dir_t;
')
- corecmd_bin_spec_domtrans($1,unpriv_userdomain)
- allow unpriv_userdomain $1:fd use;
- allow unpriv_userdomain $1:fifo_file rw_file_perms;
- allow unpriv_userdomain $1:process sigchld;
+ dontaudit $1 user_home_dir_t:dir list_dir_perms;
')
########################################
##
-## Execute generic sbin programs in all unprivileged user
-## domains. This is an explicit transition, requiring the
-## caller to use setexeccon().
+## Create user home directories.
##
##
##
@@ -3999,16 +1449,17 @@ interface(`userdom_bin_spec_domtrans_unpriv_users',`
##
##
#
-interface(`userdom_sbin_spec_domtrans_unpriv_users',`
- userdom_bin_spec_domtrans_unpriv_users($1)
- refpolicywarn(`$0() has been deprecated, please use userdom_bin_spec_domtrans_unpriv_users() instead.')
+interface(`userdom_create_user_home_dirs',`
+ gen_require(`
+ type user_home_dir_t;
+ ')
+
+ allow $1 user_home_dir_t:dir create_dir_perms;
')
########################################
##
-## Execute all entrypoint files in unprivileged user
-## domains. This is an explicit transition, requiring the
-## caller to use setexeccon().
+## Create user home directories.
##
##
##
@@ -4016,20 +1467,17 @@ interface(`userdom_sbin_spec_domtrans_unpriv_users',`
##
##
#
-interface(`userdom_entry_spec_domtrans_unpriv_users',`
+interface(`userdom_manage_user_home_dirs',`
gen_require(`
- attribute unpriv_userdomain;
+ type user_home_dir_t;
')
- domain_entry_file_spec_domtrans($1,unpriv_userdomain)
- allow unpriv_userdomain $1:fd use;
- allow unpriv_userdomain $1:fifo_file rw_file_perms;
- allow unpriv_userdomain $1:process sigchld;
+ allow $1 user_home_dir_t:dir manage_dir_perms;
')
########################################
##
-## Execute a shell in the sysadm domain.
+## Relabel to user home directories.
##
##
##
@@ -4037,29 +1485,18 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
##
##
#
-interface(`userdom_shell_domtrans_sysadm',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_shell_domtrans() instead.')
- sysadm_shell_domtrans($1)
-')
+interface(`userdom_relabelto_user_home_dirs',`
+ gen_require(`
+ type user_home_dir_t;
+ ')
-########################################
-##
-## Execute a generic bin program in the sysadm domain.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_bin_spec_domtrans_sysadm',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_bin_spec_domtrans() instead.')
- sysadm_bin_spec_domtrans($1)
+ allow $1 user_home_dir_t:dir relabelto;
')
########################################
##
-## Execute a generic sbin program in the sysadm domain. (Deprecated)
+## Create directories in the home dir root with
+## the user home directory type.
##
##
##
@@ -4067,148 +1504,75 @@ interface(`userdom_bin_spec_domtrans_sysadm',`
##
##
#
-interface(`userdom_sbin_spec_domtrans_sysadm',`
- refpolicywarn(`$0() has been deprecated, please use sysadm_bin_spec_domtrans() instead.')
- sysadm_bin_spec_domtrans($1)
-')
+interface(`userdom_home_filetrans_user_home_dir',`
+ gen_require(`
+ type user_home_dir_t;
+ ')
-########################################
-##
-## Execute all entrypoint files in the sysadm domain. This
-## is an explicit transition, requiring the
-## caller to use setexeccon().
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_entry_spec_domtrans_sysadm',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_entry_spec_domtrans() instead.')
- sysadm_entry_spec_domtrans($1)
+ files_home_filetrans($1, user_home_dir_t, dir)
')
########################################
##
-## Allow sysadm to execute a generic bin program in
-## a specified domain. This is an explicit transition,
-## requiring the caller to use setexeccon(). (Deprecated)
+## Do a domain transition to the specified
+## domain when executing a program in the
+## user home directory.
##
##
##
-## Allow sysadm to execute a generic bin program in
-## a specified domain. (Deprecated)
+## Do a domain transition to the specified
+## domain when executing a program in the
+## user home directory.
##
##
-## This is a interface to support third party modules
-## and its use is not allowed in upstream reference
-## policy.
+## No interprocess communication (signals, pipes,
+## etc.) is provided by this interface since
+## the domains are not owned by this module.
##
##
-##
+##
##
-## Domain to execute in.
+## Domain allowed access.
##
##
-#
-interface(`userdom_sysadm_bin_spec_domtrans_to',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_bin_spec_domtrans_to() instead.')
- sysadm_bin_spec_domtrans_to($1)
-')
-
-########################################
-##
-## Allow sysadm to execute a generic sbin program in
-## a specified domain. This is an explicit transition,
-## requiring the caller to use setexeccon(). (Deprecated)
-##
-##
-##
-## Allow sysadm to execute a generic sbin program in
-## a specified domain. (Deprecated)
-##
-##
-## This is a interface to support third party modules
-## and its use is not allowed in upstream reference
-## policy.
-##
-##
-##
+##
##
-## Domain to execute in.
+## Domain to transition to.
##
##
#
-interface(`userdom_sysadm_sbin_spec_domtrans_to',`
- refpolicywarn(`$0() has been deprecated, please use sysadm_bin_spec_domtrans_to() instead.')
- sysadm_bin_spec_domtrans_to($1)
-')
+interface(`userdom_user_home_domtrans',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
-########################################
-##
-## Allow sysadm to execute all entrypoint files
-## in the specified domain. This is an explicit
-## transition, requiring the caller to use setexeccon().
-##
-##
-##
-## Allow sysadm to execute all entrypoint files
-## in the specified domain. This is an explicit
-## transition, requiring the caller to use setexeccon().
-##
-##
-## This is a interface to support third party modules
-## and its use is not allowed in upstream reference
-## policy.
-##
-##
-##
-##
-## Domain to execute in.
-##
-##
-#
-interface(`userdom_sysadm_entry_spec_domtrans_to',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_entry_spec_domtrans() instead.')
- sysadm_entry_spec_domtrans($1)
+ domain_auto_trans($1, user_home_t, $2)
+ allow $1 user_home_dir_t:dir search_dir_perms;
+ files_search_home($1)
')
########################################
##
-## Search the staff users home directory.
+## Do not audit attempts to search user home content directories.
##
##
##
-## Domain allowed access.
+## Domain to not audit
##
##
#
-interface(`userdom_search_staff_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use staff_search_home_dirs() instead.')
- staff_search_home_dirs($1)
-')
+interface(`userdom_dontaudit_search_user_home_content',`
+ gen_require(`
+ type user_home_t;
+ ')
-########################################
-##
-## Do not audit attempts to search the staff
-## users home directory.
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-interface(`userdom_dontaudit_search_staff_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use staff_dontaudit_search_home_dirs() instead.')
- staff_dontaudit_search_home_dirs($1)
+ dontaudit $1 user_home_t:dir search_dir_perms;
')
########################################
##
-## Create, read, write, and delete staff
-## home directories.
+## Create, read, write, and delete directories
+## in a user home subdirectory.
##
##
##
@@ -4216,14 +1580,19 @@ interface(`userdom_dontaudit_search_staff_home_dirs',`
##
##
#
-interface(`userdom_manage_staff_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use staff_manage_home_dirs() instead.')
- staff_manage_home_dirs($1)
+interface(`userdom_manage_user_home_content_dirs',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+ files_search_home($1)
')
########################################
##
-## Relabel to staff home directories.
+## Do not audit attempts to set the
+## attributes of user home files.
##
##
##
@@ -4231,30 +1600,17 @@ interface(`userdom_manage_staff_home_dirs',`
##
##
#
-interface(`userdom_relabelto_staff_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use staff_relabelto_home_dirs() instead.')
- staff_relabelto_home_dirs($1)
-')
+interface(`userdom_dontaudit_setattr_user_home_content_files',`
+ gen_require(`
+ type user_home_t;
+ ')
-########################################
-##
-## Do not audit attempts to append to the staff
-## users home directory.
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-interface(`userdom_dontaudit_append_staff_home_content_files',`
- refpolicywarn(`$0($*) has been deprecated. Please use staff_dontaudit_append_home_content_files() instead.')
- staff_dontaudit_append_home_content_files($1)
+ dontaudit $1 user_home_t:file setattr;
')
########################################
##
-## Read files in the staff users home directory.
+## Mmap user home files.
##
##
##
@@ -4262,30 +1618,18 @@ interface(`userdom_dontaudit_append_staff_home_content_files',`
##
##
#
-interface(`userdom_read_staff_home_content_files',`
- refpolicywarn(`$0($*) has been deprecated. Please use staff_read_home_content_files() instead.')
- staff_read_home_content_files($1)
-')
+interface(`userdom_mmap_user_home_content_files',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
-########################################
-##
-## Send a SIGCHLD signal to sysadm users.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_sigchld_sysadm',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_sigchld() instead.')
- sysadm_sigchld($1)
+ mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+ files_search_home($1)
')
########################################
##
-## Do not audit attepts to get the attributes
-## of sysadm ttys.
+## Read user home files.
##
##
##
@@ -4293,29 +1637,37 @@ interface(`userdom_sigchld_sysadm',`
##
##
#
-interface(`userdom_dontaudit_getattr_sysadm_ttys',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_getattr_ttys() instead.')
- sysadm_dontaudit_getattr_ttys($1)
+interface(`userdom_read_user_home_content_files',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+ files_search_home($1)
')
########################################
##
-## Read and write sysadm ttys.
+## Do not audit attempts to read user home files.
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
-interface(`userdom_use_sysadm_ttys',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_use_ttys() instead.')
- sysadm_use_ttys($1)
+interface(`userdom_dontaudit_read_user_home_content_files',`
+ gen_require(`
+ type user_home_t;
+ ')
+
+ dontaudit $1 user_home_t:dir list_dir_perms;
+ dontaudit $1 user_home_t:file read_file_perms;
')
########################################
##
-## Do not audit attempts to use sysadm ttys.
+## Do not audit attempts to append user home files.
##
##
##
@@ -4323,29 +1675,35 @@ interface(`userdom_use_sysadm_ttys',`
##
##
#
-interface(`userdom_dontaudit_use_sysadm_ttys',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_use_ttys() instead.')
- sysadm_dontaudit_use_ttys($1)
+interface(`userdom_dontaudit_append_user_home_content_files',`
+ gen_require(`
+ type user_home_t;
+ ')
+
+ dontaudit $1 user_home_t:file append;
')
########################################
##
-## Read and write sysadm ptys.
+## Do not audit attempts to write user home files.
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
-interface(`userdom_use_sysadm_ptys',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_use_ptys() instead.')
- sysadm_use_ptys($1)
+interface(`userdom_dontaudit_write_user_home_content_files',`
+ gen_require(`
+ type user_home_t;
+ ')
+
+ dontaudit $1 user_home_t:file write;
')
########################################
##
-## Dont audit attempts to read and write sysadm ptys.
+## Do not audit attempts to write user home files.
##
##
##
@@ -4353,14 +1711,17 @@ interface(`userdom_use_sysadm_ptys',`
##
##
#
-interface(`userdom_dontaudit_use_sysadm_ptys',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_use_ptys() instead.')
- sysadm_dontaudit_use_ptys($1)
+interface(`userdom_dontaudit_relabel_user_home_content_files',`
+ gen_require(`
+ type user_home_t;
+ ')
+
+ dontaudit $1 user_home_t:file relabel_file_perms;
')
########################################
##
-## Read and write sysadm ttys and ptys.
+## Read user home subdirectory symbolic links.
##
##
##
@@ -4368,29 +1729,46 @@ interface(`userdom_dontaudit_use_sysadm_ptys',`
##
##
#
-interface(`userdom_use_sysadm_terms',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_use_terms() instead.')
- sysadm_use_terms($1)
+interface(`userdom_read_user_home_content_symlinks',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ read_lnk_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+ files_search_home($1)
')
########################################
##
-## Do not audit attempts to use sysadm ttys and ptys.
+## Execute user home files.
##
##
##
-## Domain to not audit.
+## Domain allowed access.
##
##
+##
#
-interface(`userdom_dontaudit_use_sysadm_terms',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_use_terms() instead.')
- sysadm_dontaudit_use_terms($1)
+interface(`userdom_exec_user_home_content_files',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ files_search_home($1)
+ exec_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_exec_nfs_files($1)
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
+ fs_exec_cifs_files($1)
+ ')
')
########################################
##
-## Inherit and use sysadm file descriptors
+## Do not audit attempts to execute user home files.
##
##
##
@@ -4398,14 +1776,18 @@ interface(`userdom_dontaudit_use_sysadm_terms',`
##
##
#
-interface(`userdom_use_sysadm_fds',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_use_fds() instead.')
- sysadm_use_fds($1)
+interface(`userdom_dontaudit_exec_user_home_content_files',`
+ gen_require(`
+ type user_home_t;
+ ')
+
+ dontaudit $1 user_home_t:file execute;
')
########################################
##
-## Read and write sysadm user unnamed pipes.
+## Create, read, write, and delete files
+## in a user home subdirectory.
##
##
##
@@ -4413,15 +1795,20 @@ interface(`userdom_use_sysadm_fds',`
##
##
#
-interface(`userdom_rw_sysadm_pipes',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_rw_pipes() instead.')
- sysadm_rw_pipes($1)
+interface(`userdom_manage_user_home_content_files',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ manage_files_pattern($1, user_home_t, user_home_t)
+ allow $1 user_home_dir_t:dir search_dir_perms;
+ files_search_home($1)
')
########################################
##
-## Get the attributes of the sysadm users
-## home directory.
+## Do not audit attempts to create, read, write, and delete directories
+## in a user home subdirectory.
##
##
##
@@ -4429,166 +1816,188 @@ interface(`userdom_rw_sysadm_pipes',`
##
##
#
-interface(`userdom_getattr_sysadm_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_getattr_home_dirs() instead.')
- sysadm_getattr_home_dirs($1)
+interface(`userdom_dontaudit_manage_user_home_content_dirs',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ dontaudit $1 user_home_t:dir manage_dir_perms;
')
########################################
##
-## Do not audit attempts to get the
-## attributes of the sysadm users
-## home directory.
+## Create, read, write, and delete symbolic links
+## in a user home subdirectory.
##
##
##
-## Domain to not audit.
+## Domain allowed access.
##
##
#
-interface(`userdom_dontaudit_getattr_sysadm_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_getattr_home_dirs() instead.')
- sysadm_dontaudit_getattr_home_dirs($1)
+interface(`userdom_manage_user_home_content_symlinks',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ manage_lnk_files_pattern($1, user_home_t, user_home_t)
+ allow $1 user_home_dir_t:dir search_dir_perms;
+ files_search_home($1)
')
########################################
##
-## Search the sysadm users home directory.
+## Create, read, write, and delete named pipes
+## in a user home subdirectory.
##
##
##
-## Domain to not audit.
+## Domain allowed access.
##
##
#
-interface(`userdom_search_sysadm_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_search_home_dirs() instead.')
- sysadm_search_home_dirs($1)
+interface(`userdom_manage_user_home_content_pipes',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ manage_fifo_files_pattern($1, user_home_t, user_home_t)
+ allow $1 user_home_dir_t:dir search_dir_perms;
+ files_search_home($1)
')
########################################
##
-## Do not audit attempts to search the sysadm
-## users home directory.
+## Create, read, write, and delete named sockets
+## in a user home subdirectory.
##
##
##
-## Domain to not audit.
+## Domain allowed access.
##
##
#
-interface(`userdom_dontaudit_search_sysadm_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_search_home_dirs() instead.')
- sysadm_dontaudit_search_home_dirs($1)
+interface(`userdom_manage_user_home_content_sockets',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ allow $1 user_home_dir_t:dir search_dir_perms;
+ manage_sock_files_pattern($1, user_home_t, user_home_t)
+ files_search_home($1)
')
########################################
##
-## List the sysadm users home directory.
+## Create objects in a user home directory
+## with an automatic type transition to
+## a specified private type.
##
##
##
## Domain allowed access.
##
##
-#
-interface(`userdom_list_sysadm_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_list_home_dirs() instead.')
- sysadm_list_home_dirs($1)
-')
-
-########################################
-##
-## Do not audit attempts to list the sysadm
-## users home directory.
-##
-##
+##
##
-## Domain to not audit.
+## The type of the object to create.
##
##
-#
-interface(`userdom_dontaudit_list_sysadm_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_list_home_dirs() instead.')
- sysadm_dontaudit_list_home_dirs($1)
-')
-
-########################################
-##
-## Do not audit attempts to search the sysadm
-## users home directory.
-##
-##
+##
##
-## Domain to not audit.
+## The class of the object to be created.
##
##
#
-interface(`userdom_dontaudit_read_sysadm_home_content_files',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_read_home_content_files() instead.')
- sysadm_dontaudit_read_home_content_files($1)
+interface(`userdom_user_home_dir_filetrans',`
+ gen_require(`
+ type user_home_dir_t;
+ ')
+
+ filetrans_pattern($1, user_home_dir_t, $2, $3)
+ files_search_home($1)
')
########################################
##
-## Create objects in sysadm home directories
-## with automatic file type transition.
+## Create objects in a user home directory
+## with an automatic type transition to
+## a specified private type.
##
##
##
## Domain allowed access.
##
##
-##
+##
##
-## The type of the object to be created.
+## The type of the object to create.
##
##
##
##
## The class of the object to be created.
-## If not specified, file is used.
##
##
#
-interface(`userdom_sysadm_home_dir_filetrans',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_home_dir_filetrans() instead.')
- sysadm_home_dir_filetrans($1,$2,$3)
+interface(`userdom_user_home_content_filetrans',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ filetrans_pattern($1, user_home_t, $2, $3)
+ allow $1 user_home_dir_t:dir search_dir_perms;
+ files_search_home($1)
')
########################################
##
-## Search the sysadm users home sub directories.
+## Create objects in a user home directory
+## with an automatic type transition to
+## the user home file type.
##
##
##
-## Domain to not audit.
+## Domain allowed access.
+##
+##
+##
+##
+## The class of the object to be created.
##
##
#
-interface(`userdom_search_sysadm_home_content_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_search_home_content_dirs() instead.')
- sysadm_search_home_content_dirs($1)
+interface(`userdom_user_home_dir_filetrans_user_home_content',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
+ ')
+
+ filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
+ files_search_home($1)
')
########################################
##
-## Read files in the sysadm users home directory.
+## Write to user temporary named sockets.
##
##
##
-## Domain allowed access.
+## Domain allowed access.
##
##
#
-interface(`userdom_read_sysadm_home_content_files',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_read_home_content_files() instead.')
- sysadm_read_home_content_files($1)
+interface(`userdom_write_user_tmp_sockets',`
+ gen_require(`
+ type user_tmp_t;
+ ')
+
+ allow $1 user_tmp_t:sock_file write;
+ files_search_tmp($1)
')
########################################
##
-## Read sysadm temporary files.
+## List user temporary directories.
##
##
##
@@ -4596,52 +2005,56 @@ interface(`userdom_read_sysadm_home_content_files',`
##
##
#
-interface(`userdom_read_sysadm_tmp_files',`
- refpolicywarn(`$0($*) has been deprecated. Please use sysadm_read_tmp_files() instead.')
- sysadm_read_tmp_files($1)
+interface(`userdom_list_user_tmp',`
+ gen_require(`
+ type user_tmp_t;
+ ')
+
+ allow $1 user_tmp_t:dir list_dir_perms;
+ files_search_tmp($1)
')
########################################
##
-## Search all users home directories.
+## Do not audit attempts to list user
+## temporary directories.
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
-interface(`userdom_search_all_users_home_dirs',`
+interface(`userdom_dontaudit_list_user_tmp',`
gen_require(`
- attribute home_dir_type;
+ type user_tmp_t;
')
- files_list_home($1)
- allow $1 home_dir_type:dir search_dir_perms;
+ dontaudit $1 user_tmp_t:dir list_dir_perms;
')
########################################
##
-## List all users home directories.
+## Do not audit attempts to manage users
+## temporary directories.
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
-interface(`userdom_list_all_users_home_dirs',`
+interface(`userdom_dontaudit_manage_user_tmp_dirs',`
gen_require(`
- attribute home_dir_type;
+ type user_tmp_t;
')
- files_list_home($1)
- allow $1 home_dir_type:dir list_dir_perms;
+ dontaudit $1 user_tmp_t:dir manage_dir_perms;
')
########################################
##
-## Search all users home directories.
+## Read user temporary files.
##
##
##
@@ -4649,18 +2062,20 @@ interface(`userdom_list_all_users_home_dirs',`
##
##
#
-interface(`userdom_search_all_users_home_content',`
+interface(`userdom_read_user_tmp_files',`
gen_require(`
- attribute home_dir_type, home_type;
+ type user_tmp_t;
')
- files_list_home($1)
- allow $1 { home_dir_type home_type }:dir search_dir_perms;
+ read_files_pattern($1, user_tmp_t, user_tmp_t)
+ allow $1 user_tmp_t:dir list_dir_perms;
+ files_search_tmp($1)
')
########################################
##
-## Do not audit attempts to search all users home directories.
+## Do not audit attempts to read users
+## temporary files.
##
##
##
@@ -4668,38 +2083,36 @@ interface(`userdom_search_all_users_home_content',`
##
##
#
-interface(`userdom_dontaudit_search_all_users_home_content',`
+interface(`userdom_dontaudit_read_user_tmp_files',`
gen_require(`
- attribute home_dir_type, home_type;
+ type user_tmp_t;
')
- dontaudit $1 { home_dir_type home_type }:dir search_dir_perms;
+ dontaudit $1 user_tmp_t:file read_file_perms;
')
########################################
##
-## Read all files in all users home directories.
+## Do not audit attempts to append users
+## temporary files.
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
-interface(`userdom_read_all_users_home_content_files',`
+interface(`userdom_dontaudit_append_user_tmp_files',`
gen_require(`
- attribute home_type;
+ type user_tmp_t;
')
- files_list_home($1)
- allow $1 home_type:dir list_dir_perms;
- read_files_pattern($1,home_type,home_type)
+ dontaudit $1 user_tmp_t:file append;
')
########################################
##
-## Create, read, write, and delete all directories
-## in all users home directories.
+## Read and write user temporary files.
##
##
##
@@ -4707,39 +2120,38 @@ interface(`userdom_read_all_users_home_content_files',`
##
##
#
-interface(`userdom_manage_all_users_home_content_dirs',`
+interface(`userdom_rw_user_tmp_files',`
gen_require(`
- attribute home_type;
+ type user_tmp_t;
')
- files_list_home($1)
- allow $1 home_type:dir manage_dir_perms;
+ allow $1 user_tmp_t:dir list_dir_perms;
+ rw_files_pattern($1, user_tmp_t, user_tmp_t)
+ files_search_tmp($1)
')
########################################
##
-## Create, read, write, and delete all files
-## in all users home directories.
+## Do not audit attempts to manage users
+## temporary files.
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
-interface(`userdom_manage_all_users_home_content_files',`
+interface(`userdom_dontaudit_manage_user_tmp_files',`
gen_require(`
- attribute home_type;
+ type user_tmp_t;
')
- files_list_home($1)
- manage_files_pattern($1,home_type,home_type)
+ dontaudit $1 user_tmp_t:file manage_file_perms;
')
########################################
##
-## Create, read, write, and delete all symlinks
-## in all users home directories.
+## Read user temporary symbolic links.
##
##
##
@@ -4747,47 +2159,40 @@ interface(`userdom_manage_all_users_home_content_files',`
##
##
#
-interface(`userdom_manage_all_users_home_content_symlinks',`
+interface(`userdom_read_user_tmp_symlinks',`
gen_require(`
- attribute home_type;
+ type user_tmp_t;
')
- files_list_home($1)
- manage_lnk_files_pattern($1,home_type,home_type)
+ read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
+ allow $1 user_tmp_t:dir list_dir_perms;
+ files_search_tmp($1)
')
########################################
##
-## Make the specified domain a privileged
-## home directory manager.
+## Create, read, write, and delete user
+## temporary directories.
##
-##
-##
-## Make the specified domain a privileged
-## home directory manager. This domain will be
-## able to manage the contents of all users
-## general home directory content, and create
-## files with the correct context.
-##
-##
##
##
## Domain allowed access.
##
##
#
-interface(`userdom_priveleged_home_dir_manager',`
+interface(`userdom_manage_user_tmp_dirs',`
gen_require(`
- attribute privhome;
+ type user_tmp_t;
')
- files_list_home($1)
- typeattribute $1 privhome;
+ manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
+ files_search_tmp($1)
')
########################################
##
-## Send general signals to unprivileged user domains.
+## Create, read, write, and delete user
+## temporary files.
##
##
##
@@ -4795,17 +2200,19 @@ interface(`userdom_priveleged_home_dir_manager',`
##
##
#
-interface(`userdom_signal_unpriv_users',`
+interface(`userdom_manage_user_tmp_files',`
gen_require(`
- attribute unpriv_userdomain;
+ type user_tmp_t;
')
- allow $1 unpriv_userdomain:process signal;
+ manage_files_pattern($1, user_tmp_t, user_tmp_t)
+ files_search_tmp($1)
')
########################################
##
-## Inherit the file descriptors from unprivileged user domains.
+## Create, read, write, and delete user
+## temporary symbolic links.
##
##
##
@@ -4813,18 +2220,19 @@ interface(`userdom_signal_unpriv_users',`
##
##
#
-interface(`userdom_use_unpriv_users_fds',`
+interface(`userdom_manage_user_tmp_symlinks',`
gen_require(`
- attribute unpriv_userdomain;
+ type user_tmp_t;
')
- allow $1 unpriv_userdomain:fd use;
+ manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
+ files_search_tmp($1)
')
########################################
##
-## Do not audit attempts to inherit the
-## file descriptors from all user domains.
+## Create, read, write, and delete user
+## temporary named pipes.
##
##
##
@@ -4832,18 +2240,19 @@ interface(`userdom_use_unpriv_users_fds',`
##
##
#
-interface(`userdom_dontaudit_use_unpriv_user_fds',`
+interface(`userdom_manage_user_tmp_pipes',`
gen_require(`
- attribute unpriv_userdomain;
+ type user_tmp_t;
')
- dontaudit $1 unpriv_userdomain:fd use;
+ manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
+ files_search_tmp($1)
')
########################################
##
-## Create generic user home directories
-## with automatic file type transition.
+## Create, read, write, and delete user
+## temporary named sockets.
##
##
##
@@ -4851,30 +2260,51 @@ interface(`userdom_dontaudit_use_unpriv_user_fds',`
##
##
#
-interface(`userdom_home_filetrans_generic_user_home_dir',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_home_filetrans_home_dir() instead.')
- unprivuser_home_filetrans_home_dir($1)
+interface(`userdom_manage_user_tmp_sockets',`
+ gen_require(`
+ type user_tmp_t;
+ ')
+
+ manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
+ files_search_tmp($1)
')
########################################
##
-## Search generic user home directories.
+## Create objects in a user temporary directory
+## with an automatic type transition to
+## a specified private type.
##
##
##
## Domain allowed access.
##
##
+##
+##
+## The type of the object to create.
+##
+##
+##
+##
+## The class of the object to be created.
+##
+##
#
-interface(`userdom_search_generic_user_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_search_home_dirs() instead.')
- unprivuser_search_home_dirs($1)
+interface(`userdom_user_tmp_filetrans',`
+ gen_require(`
+ type user_tmp_t;
+ ')
+
+ filetrans_pattern($1, user_tmp_t, $2, $3)
+ files_search_tmp($1)
')
########################################
##
-## Create objects in generic user home directories
-## with automatic file type transition.
+## Create objects in the temporary directory
+## with an automatic type transition to
+## the user temporary type.
##
##
##
@@ -4884,18 +2314,20 @@ interface(`userdom_search_generic_user_home_dirs',`
##
##
## The class of the object to be created.
-## If not specified, file is used.
##
##
#
-interface(`userdom_generic_user_home_dir_filetrans_generic_user_home_content',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_home_dir_filetrans_home_content() instead.')
- unprivuser_home_dir_filetrans_home_content($1, $2)
+interface(`userdom_tmp_filetrans_user_tmp',`
+ gen_require(`
+ type user_tmp_t;
+ ')
+
+ files_tmp_filetrans($1, user_tmp_t, $2)
')
########################################
##
-## Don't audit search on the user home subdirectory.
+## Read user tmpfs files.
##
##
##
@@ -4903,15 +2335,20 @@ interface(`userdom_generic_user_home_dir_filetrans_generic_user_home_content',`
##
##
#
-interface(`userdom_dontaudit_search_generic_user_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_dontaudit_search_home_dirs() instead.')
- unprivuser_dontaudit_search_home_dirs($1)
+interface(`userdom_rw_user_tmpfs_files',`
+ gen_require(`
+ type user_tmpfs_t;
+ ')
+
+ rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+ read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+ allow $1 user_tmpfs_t:dir list_dir_perms;
+ fs_search_tmpfs($1)
')
########################################
##
-## Create, read, write, and delete generic user
-## home directories.
+## Get the attributes of a user domain tty.
##
##
##
@@ -4919,16 +2356,17 @@ interface(`userdom_dontaudit_search_generic_user_home_dirs',`
##
##
#
-interface(`userdom_manage_generic_user_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_dirs() instead.')
- unprivuser_manage_home_dirs($1)
+interface(`userdom_getattr_user_ttys',`
+ gen_require(`
+ type user_tty_device_t;
+ ')
+
+ allow $1 user_tty_device_t:chr_file getattr;
')
########################################
##
-## Create, read, write, and delete
-## subdirectories of generic user
-## home directories.
+## Do not audit attempts to get the attributes of a user domain tty.
##
##
##
@@ -4936,14 +2374,17 @@ interface(`userdom_manage_generic_user_home_dirs',`
##
##
#
-interface(`userdom_manage_generic_user_home_content_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_content_dirs() instead.')
- unprivuser_manage_home_content_dirs($1)
+interface(`userdom_dontaudit_getattr_user_ttys',`
+ gen_require(`
+ type user_tty_device_t;
+ ')
+
+ dontaudit $1 user_tty_device_t:chr_file getattr;
')
########################################
##
-## Relabel to generic user home directories.
+## Set the attributes of a user domain tty.
##
##
##
@@ -4951,14 +2392,17 @@ interface(`userdom_manage_generic_user_home_content_dirs',`
##
##
#
-interface(`userdom_relabelto_generic_user_home_dirs',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_relabelto_home_dirs() instead.')
- unprivuser_relabelto_home_dirs($1)
+interface(`userdom_setattr_user_ttys',`
+ gen_require(`
+ type user_tty_device_t;
+ ')
+
+ allow $1 user_tty_device_t:chr_file setattr;
')
########################################
##
-## Read files in generic user home directories.
+## Do not audit attempts to set the attributes of a user domain tty.
##
##
##
@@ -4966,15 +2410,17 @@ interface(`userdom_relabelto_generic_user_home_dirs',`
##
##
#
-interface(`userdom_read_generic_user_home_content_files',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_read_home_content_files() instead.')
- unprivuser_read_home_content_files($1)
+interface(`userdom_dontaudit_setattr_user_ttys',`
+ gen_require(`
+ type user_tty_device_t;
+ ')
+
+ dontaudit $1 user_tty_device_t:chr_file setattr;
')
########################################
##
-## Mmap of generic user
-## home files.
+## Read and write a user domain tty.
##
##
##
@@ -4982,15 +2428,17 @@ interface(`userdom_read_generic_user_home_content_files',`
##
##
#
-interface(`userdom_mmap_generic_user_home_content_files',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_mmap_home_content_files() instead.')
- unprivuser_mmap_home_content_files($1)
+interface(`userdom_use_user_ttys',`
+ gen_require(`
+ type user_tty_device_t;
+ ')
+
+ allow $1 user_tty_device_t:chr_file rw_term_perms;
')
########################################
##
-## Create, read, write, and delete files
-## in generic user home directories.
+## Read and write a user domain pty.
##
##
##
@@ -4998,15 +2446,17 @@ interface(`userdom_mmap_generic_user_home_content_files',`
##
##
#
-interface(`userdom_manage_generic_user_home_content_files',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_content_files() instead.')
- unprivuser_manage_home_content_files($1)
+interface(`userdom_use_user_ptys',`
+ gen_require(`
+ type user_devpts_t;
+ ')
+
+ allow $1 user_devpts_t:chr_file rw_term_perms;
')
########################################
##
-## Do not audit attempts to relabel generic user
-## home files.
+## Read and write a user domain tty and pty.
##
##
##
@@ -5014,15 +2464,20 @@ interface(`userdom_manage_generic_user_home_content_files',`
##
##
#
-interface(`userdom_dontaudit_relabel_generic_user_home_content_files',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_dontaudit_relabel_home_content_files() instead.')
- unprivuser_dontaudit_relabel_home_content_files($1)
+interface(`userdom_use_user_terminals',`
+ gen_require(`
+ type user_tty_device_t, user_devpts_t;
+ ')
+
+ allow $1 user_tty_device_t:chr_file rw_term_perms;
+ allow $1 user_devpts_t:chr_file rw_term_perms;
+ term_list_ptys($1)
')
########################################
##
-## Create, read, write, and delete symbolic
-## links in generic user home directories.
+## Do not audit attempts to read and write
+## a user domain tty and pty.
##
##
##
@@ -5030,15 +2485,20 @@ interface(`userdom_dontaudit_relabel_generic_user_home_content_files',`
##
##
#
-interface(`userdom_manage_generic_user_home_content_symlinks',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_content_symlinks() instead.')
- unprivuser_manage_home_content_symlinks($1)
+interface(`userdom_dontaudit_use_user_terminals',`
+ gen_require(`
+ type user_tty_device_t, user_devpts_t;
+ ')
+
+ dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
+ dontaudit $1 user_devpts_t:chr_file rw_term_perms;
')
########################################
##
-## Create, read, write, and delete named
-## pipes in generic user home directories.
+## Execute a shell in all user domains. This
+## is an explicit transition, requiring the
+## caller to use setexeccon().
##
##
##
@@ -5046,15 +2506,22 @@ interface(`userdom_manage_generic_user_home_content_symlinks',`
##
##
#
-interface(`userdom_manage_generic_user_home_content_pipes',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_content_pipes() instead.')
- unprivuser_manage_home_content_pipes($1)
+interface(`userdom_spec_domtrans_all_users',`
+ gen_require(`
+ attribute userdomain;
+ ')
+
+ corecmd_shell_spec_domtrans($1,userdomain)
+ allow userdomain $1:fd use;
+ allow userdomain $1:fifo_file rw_file_perms;
+ allow userdomain $1:process sigchld;
')
########################################
##
-## Create, read, write, and delete named
-## sockets in generic user home directories.
+## Execute an Xserver session in all unprivileged user domains. This
+## is an explicit transition, requiring the
+## caller to use setexeccon().
##
##
##
@@ -5062,14 +2529,22 @@ interface(`userdom_manage_generic_user_home_content_pipes',`
##
##
#
-interface(`userdom_manage_generic_user_home_content_sockets',`
- refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_content_sockets() instead.')
- unprivuser_manage_home_content_sockets($1)
+interface(`userdom_xsession_spec_domtrans_all_users',`
+ gen_require(`
+ attribute userdomain;
+ ')
+
+ xserver_xsession_spec_domtrans($1,userdomain)
+ allow userdomain $1:fd use;
+ allow userdomain $1:fifo_file rw_file_perms;
+ allow userdomain $1:process sigchld;
')
########################################
##
-## Search all unprivileged users home directories.
+## Execute a shell in all unprivileged user domains. This
+## is an explicit transition, requiring the
+## caller to use setexeccon().
##
##
##
@@ -5077,19 +2552,22 @@ interface(`userdom_manage_generic_user_home_content_sockets',`
##
##
#
-interface(`userdom_search_unpriv_users_home_dirs',`
+interface(`userdom_spec_domtrans_unpriv_users',`
gen_require(`
- attribute user_home_dir_type;
+ attribute unpriv_userdomain;
')
- files_search_home($1)
- allow $1 user_home_dir_type:dir search_dir_perms;
+ corecmd_shell_spec_domtrans($1,unpriv_userdomain)
+ allow unpriv_userdomain $1:fd use;
+ allow unpriv_userdomain $1:fifo_file rw_file_perms;
+ allow unpriv_userdomain $1:process sigchld;
')
########################################
##
-## Read all unprivileged users home directory
-## files.
+## Execute an Xserver session in all unprivileged user domains. This
+## is an explicit transition, requiring the
+## caller to use setexeccon().
##
##
##
@@ -5097,21 +2575,20 @@ interface(`userdom_search_unpriv_users_home_dirs',`
##
##
#
-interface(`userdom_read_unpriv_users_home_content_files',`
+interface(`userdom_xsession_spec_domtrans_unpriv_users',`
gen_require(`
- attribute user_home_dir_type, user_home_type;
+ attribute unpriv_userdomain;
')
- files_search_home($1)
- allow $1 user_home_type:dir list_dir_perms;
- read_files_pattern($1,{ user_home_dir_type user_home_type },user_home_type)
- read_lnk_files_pattern($1,{ user_home_dir_type user_home_type },user_home_type)
+ xserver_xsession_spec_domtrans($1,unpriv_userdomain)
+ allow unpriv_userdomain $1:fd use;
+ allow unpriv_userdomain $1:fifo_file rw_file_perms;
+ allow unpriv_userdomain $1:process sigchld;
')
########################################
##
-## Create, read, write, and delete directories in
-## unprivileged users home directories.
+## Manage unpriviledged user SysV sempaphores.
##
##
##
@@ -5119,19 +2596,18 @@ interface(`userdom_read_unpriv_users_home_content_files',`
##
##
#
-interface(`userdom_manage_unpriv_users_home_content_dirs',`
+interface(`userdom_manage_unpriv_user_semaphores',`
gen_require(`
- attribute user_home_dir_type, user_home_type;
+ attribute unpriv_userdomain;
')
- files_search_home($1)
- manage_dirs_pattern($1,{ user_home_dir_type user_home_type },user_home_type)
+ allow $1 unpriv_userdomain:sem create_sem_perms;
')
########################################
##
-## Create, read, write, and delete files in
-## unprivileged users home directories.
+## Manage unpriviledged user SysV shared
+## memory segments.
##
##
##
@@ -5139,18 +2615,19 @@ interface(`userdom_manage_unpriv_users_home_content_dirs',`
##
##
#
-interface(`userdom_manage_unpriv_users_home_content_files',`
+interface(`userdom_manage_unpriv_user_shared_mem',`
gen_require(`
- attribute user_home_dir_type, user_home_type;
+ attribute unpriv_userdomain;
')
- files_search_home($1)
- manage_files_pattern($1,{ user_home_dir_type user_home_type },user_home_type)
+ allow $1 unpriv_userdomain:shm create_shm_perms;
')
########################################
##
-## Set the attributes of user ptys.
+## Execute bin_t in the unprivileged user domains. This
+## is an explicit transition, requiring the
+## caller to use setexeccon().
##
##
##
@@ -5158,17 +2635,22 @@ interface(`userdom_manage_unpriv_users_home_content_files',`
##
##
#
-interface(`userdom_setattr_unpriv_users_ptys',`
+interface(`userdom_bin_spec_domtrans_unpriv_users',`
gen_require(`
- attribute user_ptynode;
+ attribute unpriv_userdomain;
')
- allow $1 user_ptynode:chr_file setattr;
+ corecmd_bin_spec_domtrans($1,unpriv_userdomain)
+ allow unpriv_userdomain $1:fd use;
+ allow unpriv_userdomain $1:fifo_file rw_file_perms;
+ allow unpriv_userdomain $1:process sigchld;
')
########################################
##
-## Read and write unprivileged user ptys.
+## Execute all entrypoint files in unprivileged user
+## domains. This is an explicit transition, requiring the
+## caller to use setexeccon().
##
##
##
@@ -5176,37 +2658,39 @@ interface(`userdom_setattr_unpriv_users_ptys',`
##
##
#
-interface(`userdom_use_unpriv_users_ptys',`
+interface(`userdom_entry_spec_domtrans_unpriv_users',`
gen_require(`
- attribute user_ptynode;
+ attribute unpriv_userdomain;
')
- term_search_ptys($1)
- allow $1 user_ptynode:chr_file rw_file_perms;
+ domain_entry_file_spec_domtrans($1,unpriv_userdomain)
+ allow unpriv_userdomain $1:fd use;
+ allow unpriv_userdomain $1:fifo_file rw_file_perms;
+ allow unpriv_userdomain $1:process sigchld;
')
########################################
##
-## Do not audit attempts to use unprivileged
-## user ptys.
+## Search users home directories.
##
##
##
-## Domain to not audit.
+## Domain allowed access.
##
##
#
-interface(`userdom_dontaudit_use_unpriv_users_ptys',`
+interface(`userdom_search_user_home_content',`
gen_require(`
- attribute user_ptynode;
+ type user_home_dir_t, user_home_t;
')
- dontaudit $1 user_ptynode:chr_file rw_file_perms;
+ files_list_home($1)
+ allow $1 { user_home_dir_t user_home_t }:dir search_dir_perms;
')
########################################
##
-## Relabel files to unprivileged user pty types.
+## Send general signals to unprivileged user domains.
##
##
##
@@ -5214,18 +2698,17 @@ interface(`userdom_dontaudit_use_unpriv_users_ptys',`
##
##
#
-interface(`userdom_relabelto_unpriv_users_ptys',`
+interface(`userdom_signal_unpriv_users',`
gen_require(`
- attribute user_ptynode;
+ attribute unpriv_userdomain;
')
- allow $1 user_ptynode:chr_file relabelto;
+ allow $1 unpriv_userdomain:process signal;
')
########################################
##
-## Do not audit attempts to relabel files from
-## unprivileged user pty types.
+## Inherit the file descriptors from unprivileged user domains.
##
##
##
@@ -5233,17 +2716,18 @@ interface(`userdom_relabelto_unpriv_users_ptys',`
##
##
#
-interface(`userdom_dontaudit_relabelfrom_unpriv_users_ptys',`
+interface(`userdom_use_unpriv_users_fds',`
gen_require(`
- attribute user_ptynode;
+ attribute unpriv_userdomain;
')
- dontaudit $1 user_ptynode:chr_file relabelfrom;
+ allow $1 unpriv_userdomain:fd use;
')
########################################
##
-## Read all unprivileged users temporary directories.
+## Do not audit attempts to inherit the
+## file descriptors from all user domains.
##
##
##
@@ -5251,35 +2735,35 @@ interface(`userdom_dontaudit_relabelfrom_unpriv_users_ptys',`
##
##
#
-interface(`userdom_list_unpriv_users_tmp',`
+interface(`userdom_dontaudit_use_unpriv_user_fds',`
gen_require(`
- attribute user_tmpfile;
+ attribute unpriv_userdomain;
')
- allow $1 user_tmpfile:dir list_dir_perms;
+ dontaudit $1 unpriv_userdomain:fd use;
')
########################################
##
-## Read all unprivileged users temporary files.
+## Do not audit attempts to use user ptys.
##
##
##
-## Domain allowed access.
+## Domain to not audit.
##
##
#
-interface(`userdom_read_unpriv_users_tmp_files',`
+interface(`userdom_dontaudit_use_user_ptys',`
gen_require(`
- attribute user_tmpfile;
+ type user_devpts_t;
')
- allow $1 user_tmpfile:file read_file_perms;
+ dontaudit $1 user_devpts_t:chr_file rw_file_perms;
')
########################################
##
-## Read all unprivileged users temporary symbolic links.
+## Relabel files to unprivileged user pty types.
##
##
##
@@ -5287,17 +2771,18 @@ interface(`userdom_read_unpriv_users_tmp_files',`
##
##
#
-interface(`userdom_read_unpriv_users_tmp_symlinks',`
+interface(`userdom_relabelto_user_ptys',`
gen_require(`
- attribute user_tmpfile;
+ type user_devpts_t;
')
- allow $1 user_tmpfile:lnk_file { getattr read };
+ allow $1 user_devpts_t:chr_file relabelto;
')
########################################
##
-## Write all unprivileged users files in /tmp
+## Do not audit attempts to relabel files from
+## user pty types.
##
##
##
@@ -5305,17 +2790,17 @@ interface(`userdom_read_unpriv_users_tmp_symlinks',`
##
##
#
-interface(`userdom_write_unpriv_users_tmp_files',`
+interface(`userdom_dontaudit_relabelfrom_user_ptys',`
gen_require(`
- attribute user_tmpfile;
+ type user_devpts_t;
')
- allow $1 user_tmpfile:file write_file_perms;
+ dontaudit $1 user_devpts_t:chr_file relabelfrom;
')
########################################
##
-## Read and write unprivileged user ttys.
+## Write all users files in /tmp
##
##
##
@@ -5323,18 +2808,17 @@ interface(`userdom_write_unpriv_users_tmp_files',`
##
##
#
-interface(`userdom_use_unpriv_users_ttys',`
+interface(`userdom_write_user_tmp_files',`
gen_require(`
- attribute user_ttynode;
+ type user_tmp_t;
')
- allow $1 user_ttynode:chr_file rw_term_perms;
+ allow $1 user_tmp_t:file write_file_perms;
')
########################################
##
-## Do not audit attempts to use unprivileged
-## user ttys.
+## Do not audit attempts to use user ttys.
##
##
##
@@ -5342,12 +2826,12 @@ interface(`userdom_use_unpriv_users_ttys',`
##
##
#
-interface(`userdom_dontaudit_use_unpriv_users_ttys',`
+interface(`userdom_dontaudit_use_user_ttys',`
gen_require(`
- attribute user_ttynode;
+ type user_tty_device_t;
')
- dontaudit $1 user_ttynode:chr_file rw_file_perms;
+ dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
')
########################################
@@ -5496,17 +2980,3 @@ interface(`userdom_dbus_send_all_users',`
allow $1 userdomain:dbus send_msg;
')
-
-########################################
-##
-## Unconfined access to user domains. (Deprecated)
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`userdom_unconfined',`
- refpolicywarn(`$0($*) has been deprecated.')
-')
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index f53a5de..201c359 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -1,5 +1,5 @@
-policy_module(userdomain, 3.2.0)
+policy_module(userdomain, 4.0.0)
########################################
#
@@ -49,33 +49,6 @@ gen_tunable(user_rw_noexattrfile,false)
##
gen_tunable(user_ttyfile_stat,false)
-# admin users terminals (tty and pty)
-attribute admin_terminal;
-
-# users home directory
-attribute home_dir_type;
-
-# users home directory contents
-attribute home_type;
-
-# The privhome attribute identifies every domain that can create files under
-# regular user home directories in the regular context (IE act on behalf of
-# a user in writing regular files)
-attribute privhome;
-
-# all unprivileged users home directories
-attribute user_home_dir_type;
-attribute user_home_type;
-
-# all unprivileged users ptys
-attribute user_ptynode;
-
-# all unprivileged users tmp files
-attribute user_tmpfile;
-
-# all unprivileged users ttys
-attribute user_ttynode;
-
# all user domains
attribute userdomain;
@@ -84,3 +57,41 @@ attribute unpriv_userdomain;
attribute untrusted_content_type;
attribute untrusted_content_tmp_type;
+
+type user_home_dir_t alias { staff_home_dir_t sysadm_home_dir_t secadm_home_dir_t auditadm_home_dir_t unconfined_home_dir_t };
+fs_associate_tmpfs(user_home_dir_t)
+files_type(user_home_dir_t)
+files_mountpoint(user_home_dir_t)
+files_associate_tmp(user_home_dir_t)
+files_poly(user_home_dir_t)
+files_poly_member(user_home_dir_t)
+files_poly_parent(user_home_dir_t)
+ubac_constrained(user_home_dir_t)
+
+type user_home_t alias { staff_home_t sysadm_home_t secadm_home_t auditadm_home_t unconfined_home_t };
+typealias user_home_t alias { staff_untrusted_content_t sysadm_untrusted_content_t secadm_untrusted_content_t auditadm_untrusted_content_t unconfined_untrusted_content_t };
+userdom_user_home_content(user_home_t)
+fs_associate_tmpfs(user_home_t)
+files_associate_tmp(user_home_t)
+files_poly_member(user_home_t)
+files_poly_parent(user_home_t)
+files_mountpoint(user_home_t)
+ubac_constrained(user_home_t)
+
+type user_devpts_t alias { staff_devpts_t sysadm_devpts_t secadm_devpts_t auditadm_devpts_t unconfined_devpts_t };
+dev_node(user_devpts_t)
+files_type(user_devpts_t)
+ubac_constrained(user_devpts_t)
+
+type user_tmp_t alias { staff_tmp_t sysadm_tmp_t secadm_tmp_t auditadm_tmp_t unconfined_tmp_t };
+typealias user_tmp_t alias { staff_untrusted_content_tmp_t sysadm_untrusted_content_tmp_t secadm_untrusted_content_tmp_t auditadm_untrusted_content_tmp_t unconfined_untrusted_content_tmp_t };
+files_tmp_file(user_tmp_t)
+userdom_user_home_content(user_tmp_t)
+
+type user_tmpfs_t alias { staff_tmpfs_t sysadm_tmpfs_t secadm_tmpfs_t auditadm_tmpfs_t unconfined_tmpfs_t };
+files_tmpfs_file(user_tmpfs_t)
+userdom_user_home_content(user_tmpfs_t)
+
+type user_tty_device_t alias { staff_tty_device_t sysadm_tty_device_t secadm_tty_device_t auditadm_tty_device_t unconfined_tty_device_t };
+dev_node(user_tty_device_t)
+ubac_constrained(user_tty_device_t)
diff --git a/policy/modules/system/xen.te b/policy/modules/system/xen.te
index 9e95995..80caa8b 100644
--- a/policy/modules/system/xen.te
+++ b/policy/modules/system/xen.te
@@ -1,5 +1,5 @@
-policy_module(xen, 1.7.0)
+policy_module(xen, 1.7.1)
########################################
#
@@ -201,12 +201,12 @@ sysnet_delete_dhcpc_pid(xend_t)
sysnet_read_dhcpc_pid(xend_t)
sysnet_rw_dhcp_config(xend_t)
+userdom_dontaudit_search_user_home_dirs(xend_t)
+
xen_stream_connect_xenstore(xend_t)
netutils_domtrans(xend_t)
-sysadm_dontaudit_search_home_dirs(xend_t)
-
optional_policy(`
consoletype_exec(xend_t)
')
diff --git a/policy/rolemap b/policy/rolemap
index 729ed88..c1de37e 100644
--- a/policy/rolemap
+++ b/policy/rolemap
@@ -1,6 +1,6 @@
#
# This file contains the mappings
-# used for per-userdomain template
+# used for per-role template
# infrastructure. Each line describes
# the prefix and user domain type
# corresponding to each role.
@@ -8,11 +8,6 @@
# syntax: role prefix user_domain
#
-user_r user user_t
-staff_r staff staff_t
-sysadm_r sysadm sysadm_t
-
-ifdef(`enable_mls',`
- secadm_r secadm secadm_t
- auditadm_r auditadm auditadm_t
-')
+# This support has been deprecated and
+# will be removed in the future. Note: No
+# per-role templates exist in refpolicy.
diff --git a/support/Makefile.devel b/support/Makefile.devel
index a944df0..87be614 100644
--- a/support/Makefile.devel
+++ b/support/Makefile.devel
@@ -62,6 +62,10 @@ ifeq ($(DIRECT_INITRC),y)
M4PARAM += -D direct_sysadm_daemon
endif
+ifeq "$(UBAC)" "y"
+ M4PARAM += -D enable_ubac
+endif
+
# default MLS/MCS sensitivity and category settings.
MLS_SENS ?= 16
MLS_CATS ?= 256